Senior Security Operations Engineer, AIDC

Skills

About the Role

You will own the full-stack security operations for Asian AI data centers, covering detection engineering, incident response, host and network hardening, vulnerability management, and security tooling development. You will serve as a critical node in the global 7x24 security operations, coordinating with Americas and European security teammates to ensure continuous monitoring across all AIDCs worldwide. You will work on the front lines of security operations for GPU clouds, InfiniBand high-speed networks, and large-scale GPU clusters, hands-on from writing detection rules to driving live incident response.

Requirements

• Bachelor's degree or higher in Computer Science, Cybersecurity, Computer Engineering, or related field
• 5+ years of hands-on information security experience, with at least 3 years focused on cloud infrastructure / IaaS / data center security operations
• Independent incident response capability as L2/L3 analyst or IR team member
• Strong Linux system administration and hardening skills
• Hands-on experience with at least one mainstream SIEM platform (Wazuh / Splunk / Elastic SIEM)
• Familiar with container (Docker) and Kubernetes security fundamentals
• Strong scripting skills in Python and Shell
• Solid network security fundamentals including TCP/IP, firewalls, IPS/IDS, VPN, traffic analysis
• Familiar with MITRE ATT&CK Framework
• Professional fluency in both English and Mandarin Chinese
• Willing to accept irregular working hours and participate in on-call during major incidents

Responsibilities

• Own security alert monitoring, triage, and incident response for Asian AIDCs (7x24 on-call rotation)
• Provide global AIDC alert coverage during Americas and Europe off-hours
• Independently handle L2/L3 security incidents including anomalous GPU utilization, cryptojacking, SSH brute force, anomalous login, container escape events, IB/RoCE network anomalies, and BMC out-of-band unauthorized access
• Participate in P0/P1 incident response, executing forensics, containment, and recovery operations
• Maintain and update Asia regional incident response playbooks and runbooks
• Participate in quarterly IR tabletop exercises
• Own post-incident reviews, producing root cause analysis reports and driving closed-loop remediation
• Operate the SIEM platform daily including detection rule tuning, false positive suppression, log source onboarding, and health monitoring
• Independently write detection rules covering GPU cloud attack vectors
• Operate HIDS and eBPF runtime security tools including agent deployment coverage and alert policy maintenance
• Participate in detection-as-code practices including Git version-controlled detection rules, CI/CD pipelines, and unit testing
• Participate in regular threat hunting activities based on MITRE ATT&CK Cloud Matrix
• Execute host hardening on AIDC servers including Linux CIS Benchmark baseline configuration, auditd standardization, and SSH hardening
• Track CVEs for NVIDIA GPU drivers, CUDA, NCCL, UFM, and BMC firmware
• Partner with the platform engineering team on vulnerability assessments and patch deployments
• Participate in KVM/QEMU virtualization security baseline maintenance and escape detection rule updates
• Support IAM and privileged access management daily operations
• Execute periodic asset scanning and vulnerability management and track SLA compliance rates
• Participate in firewall rule maintenance, IPS/WAF policy tuning, and security change approvals
• Perform network traffic analysis to identify anomalous outbound traffic, data exfiltration behavior, and C2 communication signatures
• Maintain IB/RoCE network security monitoring
• Participate in DDoS response plan maintenance and drills
• Develop and maintain security automation scripts and tools
• Participate in testing, deployment, and feedback for in-house security products
• Write security operations documentation and maintain the SOC knowledge base
• Establish daily handoff mechanisms with Americas security teammates
• Support the GRC Manager with SOC 2 and ISO 27001 evidence collection
• Participate in Asia time zone customer security incident response and remediation

Benefits

• Attractive welfare benefits and developmental opportunities such as training and mentoring